Medium severity · published Sep 20, 2026
CVE-2026-94112
mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EZ
ezBookkeeping · mayswind
before 2.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94112
github.com
https://github.com/mayswind/ezbookkeeping/commit/3dd6286d7a3ab0f980a6d36339b9c9c4df9467e4
github.com
https://github.com/mayswind/ezbookkeeping/releases/tag/v2.0.0
github.com
https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-p6qr-48g6-97q3
www.vulncheck.com
https://www.vulncheck.com/advisories/mayswind-ezbookkeeping-before-2.0.0-totp-replay-attack
More from ezBookkeeping
9.8
CVE-2024-57604
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component
6.5
CVE-2025-65519
mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing
6.3
CVE-2024-57603
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting
5.4
CVE-2026-105131
mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint